{"record":{"id":"8b9a12afab408bbd","repo":"theonedev/onedev","slug":"invalid-lfs-object-id","errorCode":null,"errorMessage":"Invalid LFS object id","messagePattern":"Invalid LFS object id","errorType":"validation","errorClass":"ExplicitException","httpStatus":null,"severity":"error","filePath":"server-core/src/main/java/io/onedev/server/git/LfsObject.java","lineNumber":49,"sourceCode":"\npublic class LfsObject implements Serializable {\n\t\n\tprivate static final long serialVersionUID = 1L;\n\n\t/**\n\t * A Git LFS oid is a lowercase hex SHA-256 digest (64 characters). Anything\n\t * else is invalid and must never be used as a filesystem path component, as\n\t * the on-disk layout below derives the storage path directly from it.\n\t */\n\tprivate static final Pattern OBJECT_ID_PATTERN = Pattern.compile(\"[0-9a-f]{64}\");\n\n\tprivate final Long projectId;\n\t\n\tprivate final String objectId;\n\t\n\tpublic LfsObject(Long projectId, String objectId) {\n\t\tif (!isValidObjectId(objectId))\n\t\t\tthrow new ExplicitException(\"Invalid LFS object id\");\n\t\tthis.projectId = projectId;\n\t\tthis.objectId = objectId;\n\t}\n\n\tpublic static boolean isValidObjectId(@Nullable String objectId) {\n\t\treturn objectId != null && OBJECT_ID_PATTERN.matcher(objectId).matches();\n\t}\n\n\tpublic Long getProjectId() {\n\t\treturn projectId;\n\t}\n\n\tpublic String getObjectId() {\n\t\treturn objectId;\n\t}\n\n\tprivate ProjectService getProjectService() {\n\t\treturn OneDev.getInstance(ProjectService.class);","sourceCodeStart":31,"sourceCodeEnd":67,"githubUrl":"https://github.com/theonedev/onedev/blob/d44925c47c37992c828ea673a5f9620539bc3ff2/server-core/src/main/java/io/onedev/server/git/LfsObject.java#L31-L67","documentation":"LfsObject's constructor validates that the objectId matches OBJECT_ID_PATTERN (an OID/SHA-like pattern, see isValidObjectId) and throws ExplicitException(\"Invalid LFS object id\") otherwise. This guards the LFS object storage against malformed identifiers.","triggerScenarios":"Constructing new LfsObject(projectId, objectId) with a null, empty, or non-hex id that does not satisfy isValidObjectId — e.g. an id read from a malformed LFS pointer file, a truncated request parameter, or a client-supplied path component.","commonSituations":"Corrupt or hand-edited LFS pointer files; API/git clients sending wrong query params; attempting to look up LFS objects with a Git blob SHA or a different hash length instead of the LFS OID.","solutions":["Validate with LfsObject.isValidObjectId(id) before constructing and surface a clear message to the caller","Fix the source of the id — re-read the LFS pointer file or the client request that produced the malformed OID","Re-push the affected files with a working git-lfs client if pointer files are corrupted"],"exampleFix":"// before\nnew LfsObject(projectId, somePathSegment); // may throw\n// after\nif (LfsObject.isValidObjectId(oid)) {\n  new LfsObject(projectId, oid);\n} else {\n  throw new IllegalArgumentException(\"Malformed LFS OID: \" + oid);\n}","handlingStrategy":"validation","validationCode":"// call before constructing\nif (!LfsObject.isValidObjectId(oid))\n  throw new IllegalArgumentException(\"LFS OID must match OID pattern: \" + oid);","typeGuard":"boolean isLfsOid(String s) {\n  return s != null && s.length() == 64 && s.chars().allMatch(c -> (c>='0'&&c<='9')||(c>='a'&&c<='f'));\n}","tryCatchPattern":"try {\n  LfsObject obj = new LfsObject(projectId, oid);\n} catch (ExplicitException e) {\n  if (\"Invalid LFS object id\".equals(e.getMessage())) {\n    // re-read pointer file / request param\n  }\n}","preventionTips":["Parse OIDs only from well-formed LFS pointer files","Sanitize client-supplied path/query components before using as OID","Log the raw id on failure to spot truncation early"],"tags":["git-lfs","validation","object-id"],"backgroundTag":"invalid-identifier-format","analyzedSha":"d44925c47c37992c828ea673a5f9620539bc3ff2","analyzedAt":"2026-09-06T07:18:27.995Z","contentChangedAt":"2026-09-06T07:18:27.995Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}